Install Icinga2 + Icinga Web 2 on Oracle Linux 8.5

dokon · January 26, 2022, 9:44pm

Install Icinga2 + Icinga Web 2 on Oracle Linux 8.5

As Oracle Linux is not found on ICINGAs official Compatibility List

Requirements

Author: @dokon
Revision: v0.1

Tested with:

Icinga 2 v2.13.2-1

Icinga Web 2 v2.9.5

Linux

[root@localhost ~]# cat /etc/os-release && uname -r
NAME="Oracle Linux Server"
VERSION="8.5"
ID="ol"
ID_LIKE="fedora"
VARIANT="Server"
VARIANT_ID="server"
VERSION_ID="8.5"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Oracle Linux Server 8.5"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:oracle:linux:8:5:server"
HOME_URL="https://linux.oracle.com/"
BUG_REPORT_URL="https://bugzilla.oracle.com/"

ORACLE_BUGZILLA_PRODUCT="Oracle Linux 8"
ORACLE_BUGZILLA_PRODUCT_VERSION=8.5
ORACLE_SUPPORT_PRODUCT="Oracle Linux"
ORACLE_SUPPORT_PRODUCT_VERSION=8.5
5.4.17-2136.300.7.el8uek.x86_64

Installation

OS Updates & enabled repositories

[root@localhost yum.repos.d]# cat oracle-epel-ol8.repo 
[ol8_developer_EPEL]
name=Oracle Linux $releasever EPEL Packages for Development ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/developer/EPEL/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=1

[root@localhost yum.repos.d]# cat oraclelinux-developer-ol8.repo
[ol8_developer]
name=Oracle Linux 8 Development Packages ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/developer/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=1

[ol8_developer_UEKR6]
name=Developer Preview of UEK Release 6 ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/developer/UEKR6/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0

[ol8_developer_UEKR7]
name=Developer Preview of UEK Release 7 ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/developer/UEKR7/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0

[root@localhost yum.repos.d]# cat oracle-linux-ol8.repo
[ol8_baseos_latest]
name=Oracle Linux 8 BaseOS Latest ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/baseos/latest/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=1

[ol8_appstream]
name=Oracle Linux 8 Application Stream ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/appstream/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=1

[ol8_codeready_builder]
name=Oracle Linux 8 CodeReady Builder ($basearch) - Unsupported
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/codeready/builder/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0

[ol8_distro_builder]
name=Oracle Linux 8 Distro Builder ($basearch) - Unsupported
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/distro/builder/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0

[ol8_u0_baseos_base]
name=Oracle Linux 8 BaseOS GA ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/0/baseos/base/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0

[ol8_u1_baseos_base]
name=Oracle Linux 8.1 BaseOS ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/1/baseos/base/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0

[ol8_u2_baseos_base]
name=Oracle Linux 8.2 BaseOS ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/2/baseos/base/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0

[ol8_u3_baseos_base]
name=Oracle Linux 8.3 BaseOS ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/3/baseos/base/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0

[ol8_u4_baseos_base]
name=Oracle Linux 8.4 BaseOS ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/4/baseos/base/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0

[ol8_u5_baseos_base]
name=Oracle Linux 8.5 BaseOS ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/5/baseos/base/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0

[ol8_addons]
name=Oracle Linux 8 Addons ($basearch)
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/addons/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0

[ol8_u4_security_validation]
name=Oracle Linux $releasever Update 4 ($basearch) Security Validations
baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/4/security/validation/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0

Just to be on the safe side we install for the purpose of missing dependencies packages the ‘OL8 Codeready Builder Repo’ package. This is just a fail safe if the OL8 Appstream doesn’t provide the needed package.

[OL8_codeready_builder]
name= checkmk dependencies
baseurl=http://yum.oracle.com/repo/OracleLinux/OL8/codeready/builder/x86_64
enabled=1
gpgcheck=0

The usual repository steps:

[root@localhost ~]# rpm --import https://packages.icinga.com/icinga.key
[root@localhost ~]# yum install https://packages.icinga.com/epel/icinga-rpm-release-8-latest.noarch.rpm

As we install a monitoring system we need checks to check with our fresh installed monitoring system something

[root@localhost ~]# yum install nagios-plugins-all -y

As a database backend i default also simply to mariadb-server here … as you can later change the IDO as you like just for the purpose of the ‘how to’ i choose this.

[root@localhost ~]# yum install mariadb-server -y

And finally all the icinga2 components we need.

[root@localhost ~]# yum install icinga2 -y
[root@localhost ~]# yum install icingaweb2 -y
[root@localhost ~]# yum install icinga2-ido-mysql -y

Webserver

Also here the ususal culprit (Apache2) not fancy but always in the repositories.

[root@localhost ~]# yum install httpd -y

And the php-fpm package:

I defaulted here to the php-fpm package because OL8 provides this initially without any additional steps.

[root@localhost ~]# dnf module list php
[root@localhost ~]# dnf module list reset php
[root@localhost ~]# dnf module switch-to php:7.4
[root@localhost ~]# yum install php-fpm-7.4.19 -y

Small adjustment in the php.ini

[root@localhost ~]# vi /etc/php.ini
date.timezone = 'europe/berlin' //otherwise it isn't set

Configuration

Now we start with the configuration of some of the components

Let us start with the Database:

[root@localhost ~]# systemctl enable mariadb.service --now
[root@localhost ~]# mysql_secure_installation

Advice please set a responsible root pw for the mariadb.

[root@localhost ~]# mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user.  If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none): 
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n] 
New password: 
Re-enter new password: 
Password updated successfully!
Reloading privilege tables..
 ... Success!

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] 
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] 
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] 
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] 
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

For ease of use purpose a .my.cnf file

[root@localhost ~]# vi .my.cnf

Content:

[client]
user=root
password=mysecretpassword

Now we finally create the databases:

[root@localhost ~]# mysql -e "create database icinga2;"
[root@localhost ~]# mysql -e "GRANT SELECT, INSERT, UPDATE, DELETE, DROP, CREATE VIEW, INDEX, EXECUTE ON icinga2.* TO 'icinga'@'localhost' IDENTIFIED BY 'icinga';"

We push the IDO schema into the Database

[root@localhost ~]# mysql icinga2 < /usr/share/icinga2-ido-mysql/schema/mysql.sql

After filling the schema into the database we need to adjust the icinga2 feature config

[root@localhost ~]# vi /etc/icinga2/features-available/ido-mysql.conf 

changed to:

/**
 * The IdoMysqlConnection type implements MySQL support
 * for DB IDO.
 */

object IdoMysqlConnection "ido-mysql" {
  user = "icinga"
  password = "icinga"
  host = "localhost"
  database = "icinga2"
}

Set SELinux to permissive:

[root@localhost ~]# setenforce 0
[root@localhost ~]# sed -i 's/=enforcing/=permissive/g' /etc/selinux/config

Before we go into the web2 setup via the browser we enable & start the following services

[root@localhost ~]# systemctl enable httpd --now
[root@localhost ~]# systemctl enable php-fpm --now
[root@localhost ~]# systemctl enable mariadb --now
[root@localhost ~]# systemctl enable icinga2 --now

We enable some icinga2 features before we enter the websetup

[root@localhost ~]# icinga2 feature enable ido-mysql command
Enabling feature ido-mysql. Make sure to restart Icinga 2 for these changes to take effect.
Enabling feature command. Make sure to restart Icinga 2 for these changes to take effect.
[root@localhost ~]# systemctl restart icinga2

And finally that we can enter the Web 2 setup:

[root@localhost ~]# icingacli setup token create
The newly generated setup token is: b627a51c8cdf6cbb

Depending on the placement of the host machine in your network it is necessary to adjust firewalld.
You might choose to disable it, or like below just your port and service.
I’ll leave this up to you but i wanted at least to remind you on it.

[root@localhost ~]# firewall-cmd --permanent --zone=public --add-port=80/tcp
[root@localhost ~]# firewall-cmd --permanent --zone=public --add-service=http

Web 2 Steps

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Step 7

Step 8

Step 9

Step 10

Step 11

Step 12

Step 13

Step 14

Step 15

Step 16

Conclusion

At this point you have a basic Icinga 2 + Icinga Web 2 + Icinga 2 IDO on a Oracle Linux 8.5 running.

FAQ

ToDo if anyone asks something specific

bittorf · May 4, 2023, 12:31pm

Building the packages for e.g. Oracle Linux / OL8 oder OL9 is handled here:

github.com/Icinga/icinga-packaging

rpm packages for RHEL8-clones

opened 09:29PM - 21 Mar 22 UTC

closed 01:51PM - 11 Aug 22 UTC

m-erhardt

I've noticed that you [stopped building/puplishing .rpm packages for CentOS 8](h…ttps://git.icinga.com/packaging/rpm-icingaweb2/-/commit/0d073b090ed0ecadd9aacf074f1b313b926cf3d1). I am well aware of the CentOS 8 EOL but certainly lot's of people are using this repository on other subscription-free / community based RHEL8 clones like Rocky Linux, AlmaLinux or Oracle Linux. Are there any plans to publish an .rpm repo for any of these distributions within the near future? Otherwise everyone using this repo on one of these RHEL8 clones will have to change their systems to building/deploying from source.

metalcore · July 25, 2023, 7:54am

@dokon, You rock!!!
Thank you for this well written and clear tutorial.

There is still much to do, like installing director and importing data from the old server but you got me in the right direction with this article.

Edit: I’ve mentioned this tutorial link in a post of mine about new Oracle Linux installation question.

metalcore · July 26, 2023, 6:50am

Hello again,

Just wanted to contribute from my recent experience, that this command may not work on out-of-the-box Oracle Linux 8.8 (or similar, I guess):

This is due to dependency issue with Perl missing components.
This can easily be fixed by enabling Oracle Linux 8 CodeReady Builder (x86_64) - Unsupported repo with this command:

sudo dnf config-manager --enable ol8_codeready_builder.

After that, you will be able to successfully run the command mentioned.

I hope that helps.

dokon · July 26, 2023, 7:27am

Hi !

Maybe it doesn’t work anymore but as far as i checked last Time … the following was still working and is already mentioned in the Guide.

[OL8_codeready_builder]
name= checkmk dependencies 
baseurl=http://yum.oracle.com/repo/OracleLinux/OL8/codeready/builder/x86_64
enabled=1
gpgcheck=0

There is a Typo name should be codeready dependencies
also it should be enabled

metalcore · July 26, 2023, 7:41am

Thanks @dokon .
Anyway, great guide - again. I can’t stress enough the time and searches it had saved me.
It surely beats chatGPT and what not